Usability vs. Security. Can they live together?

on YouTube ↗24m

" summary

Claim: passwords remain critical because 98% of sites still use passwords, and password strength can be estimated more realistically than composition rules. Tool: Dropbox’s estimator zxcvbn is open source and scores guesses by parts instead of rules. Built: admin UI collapses dozens of checkboxes into one dropdown with three options (no require/advise microdecisions). Outcome: simpler to build, clearer for admins, and more effective at blocking weak, guessable passwords.

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 2:30Password complexity rules
3. 6:00Balancing security and usability
4. 9:55What makes a password strong
5. 13:44Human-friendly passwords are secure
6. 17:36Password strength estimation tools
7. 19:23Simplifying admin controls
8. 21:30Key lessons

" related talks

• 29mSecurity by(e) Design?Benedek Gagyi · revo.js 2023
• 27mThe Wide Diversity of Password Requirements – And how to cope with itMoritz Horsch · PasswordsCon 2018 Stockholm
• 19mDesign and Evaluation of a Data-Driven Password MeterLorrie Faith Cranor, Blase Ur, Lujo Bauer, Noah Johnson, Pardis Emami-Naeini, Nicolas Christin, Hana Habib, Jessica Colnago, William Melicher, Henry Dixon, Felicia Alfieri, Maung Aung · CHI 2017
• 14mPasswords. Are. Not. Hard!Dom Davis · ACCU 2017
• 01h 05mPasswords are not going awayPer Thorsheim · NDC Security 2022
• 26mStudying the Impact of Managers on Password Strength and ReuseMichael Backes, Sascha Fahl, Michael Schilling, Sanam Ghorbani Lyastani, Sven Bugiel · USENIX Security '18
• 32mzxcvbn: Low-Budget Password Strength EstimationDaniel Lowe Wheeler · USENIX Security '16
• 50mPasswords don't have to be so hard!Stefán Jökull Sigurðarson · NDC Security 2024